vulnerable-next-js-poc

CVE-2025-55182 React2Shell - Proof of Concept ⚠️ SECURITY RESEARCH ONLY This repository contains a proof of concept for CVE-2025-55182 , a critical remote code execution vulnerability in React Server Components. This is for authorized security testing and research purposes only. Vulnerability...

react2shell-scanner-rce-react-next-CVE-2025-55182-CVE-2025-66478

🔍 Phoenix SCA Scanner - Universal - Version for CVE-2025-55182-CVE-2025-66478 React and Nexus Vulnerability EXTERNAL Vulnerability for React2Shell class of bugs: two freshly disclosed, unauthenticated remote code execution vulnerabilities in the React Server Components RSC "Flight"...

CVE-2025-55182-golang-PoC

CVE-2025-55182 React Server Components RCE - Go PoC ⚠️ FOR AUTHORIZED SECURITY TESTING ONLY ⚠️ Description CVE-2025-55182 also known as CVE-2025-66478 is a critical Remote Code Execution vulnerability in React Server Components Flight protocol. This tool is a Go implementation of the PoC for...

react2shellVulnApp

React2Shell Vulnerable Banking Application Lab Deliberately vulnerable banking app for CVE-2025-55182 React and CVE-2025-66478 Next.js to learn, detect, and safely exercise React2Shell. Runs unpatched React 19.0.0 and Next.js 15.0.3. Overview Fictional SecureBank built with Next.js App Router and...

CVE-2025-55182-research

CVE-2025-55182 - React Server Components RCE NOTE: Written by AI/Claude https://github.com/ejpir/CVE-2025-55182-bypass TL;DR CVE-2025-55182 is a critical RCE vulnerability in React's Flight Protocol. The attack chains path traversal + fake chunk injection + $B handler abuse to execute...

react2shell

React2Shell: RCE 0-day in React Server Components CVE-2025-55182 React and CVE-2025-66478 Next.js This repository contains exploit code for authorized security testing and educational purposes only. See also: Multiple researchers have published analyses of this vulnerability. Check the References...

CVE-2025-55182

CVE-2025-55182 If you're looking for an actual explanation, msanft/CVE-2025-55182 has a nice one with a working PoC. This repository only contains some things I tried, which yielded interestingish results. ./thing.py now contains a working PoC, most of which was taken from...

CVE-2025-55182-exp

CVE-2025-55182-exp 🔥 Overview CVE-2025-55182 is a critical Remote Code Execution RCE vulnerability in React Server Components RSC affecting Next.js applications using App Router with Server Actions. The vulnerability exists in the Flight protocol deserialization process, allowing attackers to...

react2shell-lab

React2Shell - CVE-2025-55182 Lab A comprehensive laboratory for demonstrating and testing the critical vulnerability CVE-2025-55182 in React Server Components. ⚠️ Educational Purpose Only This repository is intended for: Security research and education Understanding vulnerability mechanisms Testin...

CVE-2025-55182

CVE-2025-55182 This vulnerability allows RCE in React Server Functions, e.g. as offered by Next.js through insecure prototype references. I'm not an expert in React or Next.js, so take all the information here with a grain of salt. Background React offers Server Functions1, which can be seen as...

poc-cve-2025-55182

CVE-2025-55182 React2Shell - Proof of Concept ⚠️ WARNING: This repository is for educational and security research purposes only. Do not use this exploit against systems you do not own or have explicit permission to test. Overview This repository contains a proof-of-concept demonstration of...

R2C-CVE-2025-55182-66478

🔥React2Shell Toolkit-CVE-2025-55182 & CVE-2025-66478 🚨 Critical RCE in React Server Components & Next.js 🚨 Professional Red Team Toolkit for CVE-2025-55182 Detection & Exploitation 🔍 Features • ⚡ Quick Start • 📚 Documentation • 🤝 Connect 🎯 About CVE-2025-55182 & CVE-2025-66478 🐛 What is...

react2shell

Description: CVE-2025-55182 is a critical unauthenticated remote code execution RCE vulnerability in the react-server package used by React Server Components RSC. CVE-2025-66478 is the corresponding RCE vulnerability in Next.js, which inherits the same underlying flaw through its implementation o...

REACT-CVE-2025-55182-Lab

React-2025 CTF Lab: CVE-2025-55182 Overview This repository contains a Capture The Flag CTF lab designed strictly for educational use and security research. The environment features a vulnerable Next.js 16 e-commerce mock storefront "Quantum Supplies" specifically built to demonstrate and practic...

React2Shell-PoC-CVE-2025-55182

React2Shell Exploitation Simulation CVE-2025-55182 Note: This document is for educational and security research purposes only. Do not use it to attack systems without authorization. 1. Overview CVE-2025-55182, also known as React2Shell, is a critical Remote Code Execution RCE vulnerability...

CVE-2024-55182

CVE-2025-55182 React2Shell Vulnerablity 1. Explanation about the Vulnerablity: CVE-2025-55182 “React2Shell” is a critical Remote Code Execution RCE vulnerability inside React Server Components RSC — specifically in the React Flight protocol deserialization logic. Affects: React’s server-side...

CVE-2025-55182

CVE-2025-55182: React Server Components Unsafe Deserialization Vulnerability Overview CVE-2025-55182 also known as React2Shell is a critical unsafe deserialization vulnerability discovered in the React Flight Protocol, affecting the payload of React Server Components RSC. This vulnerability resid...

react2shell-audit

React2Shell Audit CVE-2025-55182 React2Shell Audit is a lightweight, recursive Bash script designed to detect local Next.js and React Server DOM installations vulnerable to CVE-2025-55182 React2Shell and CVE-2025-66478. 🚨 The Vulnerability React2Shell is a critical remote code execution RCE...

secure-by-default-rce-demo

Node.js RCE Mitigation: DevOps as the Last Line of Defense This project demonstrates a critical Remote Code Execution RCE vulnerability in a Next.js application specifically via Server Actions and how infrastructure hardening effectively neutralizes the attack even when the code vulnerability...

React2Shell

React2Shell 📌 React2Shell CVE-2025-55182 React2Shell is the informal name given to a critical Remote Code Execution RCE vulnerability affecting React Server Components RSC and related frameworks like Next.js. Its severity and potential impact have made it a major concern in the web development an...